redline | 2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7 | Triage

Submit
Reports

Overview

overview

Static

static

cryptolaemus

windows10-2004-x64

cryptolaemus

windows11-21h2-x64

Sharing

General

Target

2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
Size

301KB
Sample

240326-28a31sef37
MD5

832eb4dc3ed8ceb9a1735bd0c7acaf1b
SHA1

b622a406927fbb8f6cd5081bd4455fb831948fca
SHA256

2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
SHA512

3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894
SSDEEP

3072:xqK8kKqJ0kadS0V8HO4ZrgvsJ8y0IHw9TZJMfPTcZqf7D34VeqiOLCbBO6:QBkKqGF8O4Zrgc8Z9TZWTcZqf7DI/L

Score

10^/10

redline jok123 discovery infostealer motw phishing spyware stealer

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7.exe

Resource

win10v2004-20231215-en

redline jok123 discovery infostealer motw phishing spyware stealer

windows10-2004-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7.exe

Resource

win11-20240221-en

redline jok123 discovery infostealer spyware stealer

windows11-21h2-x64

7 signatures

150 seconds

Malware Config

Extracted

Family

redline

Botnet

Jok123

C2

185.215.113.67:26260

Targets

- Target
  
  2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
- Size
  
  301KB
- MD5
  
  832eb4dc3ed8ceb9a1735bd0c7acaf1b
- SHA1
  
  b622a406927fbb8f6cd5081bd4455fb831948fca
- SHA256
  
  2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
- SHA512
  
  3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894
- SSDEEP
  
  3072:xqK8kKqJ0kadS0V8HO4ZrgvsJ8y0IHw9TZJMfPTcZqf7D34VeqiOLCbBO6:QBkKqGF8O4Zrgc8Z9TZWTcZqf7DI/L
Score

10^/10

redline jok123 discovery infostealer motw phishing spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinejok123discoveryinfostealermotwphishingspywarestealer

behavioral2

redlinejok123discoveryinfostealerspywarestealer

© 2018-2024

Terms | Privacy